A common assumption among covered entities is that once an outside consulting group is running annual mock audits, internal self-auditing becomes optional. HRSA doesn't see it that way. Auditors expect to see both an outside review and a documented internal self-audit process running on top of it. Entities that skip the internal piece are missing a requirement, not just a best practice.

What HRSA Expects to See

Covered entities should be performing regular internal audits that review contract pharmacy claims, entity-owned pharmacy claims, and mixed-use claims, depending on which settings apply to the program. There's no HRSA-mandated cadence or sample size. Some entities review five claims per pharmacy per month. Others review fifteen per quarter. The specific number matters less than two things: the approach needs to be written into your policy and procedure, and you need to be able to prove you're actually following it.

If you're selected for an HRSA audit, you'll be asked to produce documentation of both your internal and independent audits, and to walk through your process and scope. Being able to speak to that process fluently, not just point to a folder of records, is part of what auditors are evaluating.

‍

What an Internal Audit Actually Checks

The specific checks differ slightly depending on whether you're reviewing contract pharmacy and entity-owned claims or mixed-use claims.

For contract pharmacy and entity-owned claims:

• Eligible encounter. Confirm the patient had an encounter at an eligible site with an eligible provider within the timeframe your policy defines, occurring on or before the date the prescription was written.
• Eligible provider. Confirm the prescription came from an eligible provider within your covered entity, or, for outside referrals, that you have documentation supporting the referral relationship as defined in your policy.
• EMR documentation. Confirm the prescription or medication appears somewhere in the patient's EMR record.
• Payer check. Confirm there's no duplicate discount risk by checking for Medicaid payers on the claim.

For mixed-use claims, the review shifts slightly:

• Order and administration. Confirm both are documented in the EMR.
• Location. Confirm the medication was administered from an eligible location.
• Patient type. Confirm the patient was listed as outpatient at the time of administration.
• Payer check. Confirm there's no duplicate discount risk, and if you carve in, confirm the appropriate billing procedures were followed to prevent one.

Using the Results

Internal audits aren't just a compliance checkbox. They're also the best opportunity to catch configuration problems in your TPA before they become a pattern. Reviewing your TPA configuration alongside these audits, including provider lists, Medicaid filters, location filters, and other eligibility settings, gives you a chance to trace any failed claims back to the root cause and adjust before the same issue repeats across a larger sample.

Building a Process You Can Defend

A self-audit program that holds up under HRSA scrutiny has a few consistent features:

A documented cadence. Whatever frequency and sample size you choose, write it into your policy and follow it consistently enough that you can show a track record, not just a plan.

A record of findings and fixes. When an internal audit surfaces a problem, document what was found and what changed as a result. That record is often what separates a minor finding from a pattern HRSA flags as a systemic gap.

Familiarity across the team. Whoever ends up in front of an auditor needs to be able to describe the internal audit process from memory, not read it off a policy document for the first time during the audit itself.

How RxTrail Handles It

We build internal audit cadences with covered entities that match the realistic size of their program, structure the documentation the way HRSA expects to see it, and review TPA configurations alongside the claim-level findings. The covered entity's job is running the day-to-day audit checks. Ours is making sure the process is documented well enough, and consistently enough, to stand up when it matters.

An internal audit process that only exists on paper won't help during a real audit. One that's actually running, with a track record to show for it, is one of the strongest things a covered entity can bring to the table.

‍